@abelxiaoxing/cadence 2.0.5 → 2.0.6

package/README.md

@@ -20,8 +20,10 @@ cadence token-link --workspace ~/cadence --reveal
 ```
 
 The global install puts `cadence` (and its alias `cadence-service`) on `PATH`.
-It needs no install script: the postinstall only creates a missing `~/.pi/agent/cadence/.env` research template, and npm may skip it (npm 12 blocks install scripts by default) without any other effect.
+Cadence ships no install script, so npm 12 and Bun, which skip untrusted install scripts by default, change nothing.
+They may still report blocked scripts from the pinned Pi SDK's dependencies: `@google/genai`'s preinstall only echoes `no-op`, and `protobufjs`'s postinstall only warns about a dependent's version scheme, so neither needs approval.
 `cadence server install` registers and starts the background service for `~/cadence` on `http://127.0.0.1:17423`; `--workspace /absolute/project` selects another workspace.
+It also creates the research template `~/.pi/agent/cadence/.env` when missing; Pi's startup card names that path until it exists.
 
 | Platform | Service                                                                                     | Starts                                       |
 | -------- | ------------------------------------------------------------------------------------------- | -------------------------------------------- |
@@ -167,8 +169,7 @@ Outbound provider proxy policy is independent of inbound HTTPS and refuses unsup
 - `skills/git-commit` requires an explicit commit request and deterministic audit; task review never commits.
 - Three pinned professional profiles in `agents/` provide readonly design/diagnosis and direct-edit implementation instructions, not execution authority.
 - `config/` contains optional research/check examples.
-  Missing-only user `.env` template creation is the only postinstall behavior; it registers no service, and nothing depends on npm running it.
-  No build/Git/provider operation runs.
+  The package has no install script; `cadence server install` creates a missing user `.env` template, and no build/Git/provider operation runs at install.
 - `node /absolute/cadence/src/operator-cli.mjs doctor|runs [workspace]` remains readonly and independent of service startup.
 
 ## Development and evidence
@@ -359,7 +360,7 @@ Byte values are UTF-8/encoded bounds where specified; they are not targets to si
 | Host refuses during startup                                    | Fixed code/stage only; unregistered exits `refused`, registered stays `quarantined` |
 | Workspace containing the private state home                    | Land on `~/cadence` (only start creates it); never move state into the working copy |
 | Restart changes the definition's workspace or Node path        | Stop with the loaded definition before rewriting, not only a signal                 |
-| npm skips or hides the install hook (`allow-scripts`)          | Nothing depends on it; only `cadence server install` registers a service            |
+| npm 12 or Bun skips untrusted install scripts by default       | Ship none; `cadence server install` registers the service and creates the template  |
 | Service manager that only signals (launchd, Windows login)     | Orderly Stop first; an unconfirmed Stop changes nothing; no SIGTERM or `taskkill`   |
 | Pi's TUI replaces an info status with the next one             | The missing-service hint is its own warning notification                            |
 
@@ -395,7 +396,7 @@ Regression owners:
 - `agent-panel`, `agent-panel-model`, `agent-panel-cadence`: panel keys/rendering and readonly owner observation that never starts, cancels or replays work.
 - `test/web/`: adapted pure/SSR tests separately from actual built-browser contexts, HTTPS, mixed clients, focus/viewports and complete downloads.
 - `package-*`, `distribution`, `service-package`, `independence`: exact tar/member/body/import/notice closure and nonactivating discovery.
-- `service-autostart`, `install-config`: explicit `cadence server` registration on systemd, launchd and the Windows Run key, definition escaping, restart/disable/mask/foreign handling, orderly Stop before every change and a postinstall that registers nothing.
+- `service-autostart`, `install-config`: explicit `cadence server` registration on systemd, launchd and the Windows Run key, definition escaping, restart/disable/mask/foreign handling, orderly Stop before every change and a package without install scripts.
 - `workspace-landing`: home-directory redirection to `~/cadence` across management, native attach and observation.
 
 Regenerate operator/service/native/browser outputs only through their canonical builders; `--check` variants compare new private output without overwriting canonical bytes.
@@ -404,6 +405,11 @@ Review the independently enumerated package member list and every emitted body,
 Keep public Pi peers external for the extension, the exact Undici/ws runtime edges, the exact optional SDK pins for the standalone owner and all upstream/font/vendor notices.
 Preserve original license bytes through their precise Git attributes; line-ending normalization must not invalidate audited source/notice hashes.
 
+### Release 2.0.6 acceptance snapshot
+
+Full `verify` passed on the 2.0.6 release tree (`8d31512` plus the version bump): 1940 root tests in 78 files (27 Windows-only controls skipped on Linux), 111 web tests, 5 real-browser scenarios and the 132-member pack audit, in the 2.0.3 environment below.
+The package ships no install script: in isolated global installs, Bun 1.3.14 blocked three scripts for 2.0.5 (Cadence's postinstall and the Pi SDK's `@google/genai` and `protobufjs` scripts) and only those two SDK scripts for 2.0.6, and npm 11 lists only them.
+
 ### Release 2.0.5 acceptance snapshot
 
 Full `verify` passed on the 2.0.5 release tree (`dce261b` plus the version bump): 1940 root tests in 78 files (27 Windows-only controls skipped on Linux), 111 web tests, 5 real-browser scenarios and the 133-member pack audit, in the 2.0.3 environment below.

package/docs/service-management.md

@@ -36,7 +36,8 @@ cadence server uninstall
 ```
 
 Only these explicit commands register, change or remove the service; no package install, update hook, `/cadence` or browser visit does.
-The package postinstall only creates a missing research `.env` template, so npm skipping it (`allow-scripts`, npm 12's default) changes nothing else.
+The package has no install script, so npm 12 and Bun skipping untrusted scripts by default changes nothing; the pinned Pi SDK's blocked `@google/genai` preinstall only echoes `no-op`, and its `protobufjs` postinstall only warns about version schemes.
+`install` also creates the research template `~/.pi/agent/cadence/.env` when it is missing, never overwriting it, whatever the service result.
 `install` works from any package location and runs `start --foreground --workspace` (Linux, macOS) or `start --workspace` (Windows) from that copy with the installing Node, without `--port`.
 The workspace is `~/cadence` (created if missing), an existing absolute `--workspace`, or on later installs the one the definition already runs; a workspace containing the service's state home lands on `~/cadence` with a note.
 A new workspace selects `http://127.0.0.1:17423`; a port saved by an earlier start of that workspace still wins, and an occupied endpoint fails instead of falling back.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abelxiaoxing/cadence",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "description": "Shared Pi task workspace: native terminal and WebUI, persistent service, checks and human review.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,6 @@
     "src/agent-panel.ts",
     "src/cadence-service.mjs",
     "src/index.ts",
-    "src/install-config.mjs",
     "src/native-build.ts",
     "src/native-client.ts",
     "src/native-export.ts",
@@ -72,7 +71,6 @@
     ]
   },
   "scripts": {
-    "postinstall": "node src/install-config.mjs",
     "pack:check": "node scripts/pack-check.mjs",
     "traceability:check": "node scripts/traceability-check.mjs",
     "verify": "bun run check && bun run check:web && bun run build:web:check && bun run lint && bun run check:agents && bun run test && bun run test:web && bun run test:browser && bun run pack:check",

package/src/index.ts

@@ -3,7 +3,7 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { registerAgentPanel } from "./agent-panel.ts";
 import { registerCadenceAgentFeed } from "./agent-panel-cadence.ts";
 import { autostartNotice } from "./native-client.ts";
-import { startupCardLines } from "./startup-card.ts";
+import { CONFIG_MISSING, startupCardLines } from "./startup-card.ts";
 import { registerTaskShell } from "./task-shell.ts";
 
 /** Sole production composition. Discovery registers inert capabilities only;
@@ -25,7 +25,11 @@ export default function register(pi: ExtensionAPI): void {
         home: os.homedir(),
         projectTrusted: ctx.isProjectTrusted(),
       });
-      const shown = lines.length > 1 ? lines.slice(1) : lines;
+      // An existing file's path is noise; a missing one says where to create it.
+      const shown =
+        lines.length > 1 && !lines[0].endsWith(CONFIG_MISSING)
+          ? lines.slice(1)
+          : lines;
       ctx.ui.notify(shown.join("\n"), "info");
       // A later info status replaces this card in Pi's TUI; a warning stays.
       const autostart = autostartNotice();